finance-variance-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data as it processes user-provided financial figures (budget, actuals, and period data) to generate reports.
- Ingestion points: User-supplied financial data in Step 1 (analysis period, budget vs. actual figures, historical performance).
- Boundary markers: The instructions do not define specific delimiters or "ignore instructions" tags for the interpolated data.
- Capability inventory: The skill performs mathematical calculations and routes text output to other internal skills (
moai-coworker:ai-slop-reviewer,moai-writer:korean-humanize). It does not possess direct shell execution or external network capabilities. - Sanitization: There is no explicit sanitization or validation of the input data before it is processed by the logic chains.
- [SAFE]: All referenced skills (e.g.,
moai-coworker,moai-writer,moai-officer) are internal resources belonging to the vendor ecosystem (modu-ai), representing legitimate tool-chaining for document formatting and review.
Audit Metadata